Measuring Security with a Score System
Dalton Cézane Gomes Valadares, Ângelo Perkusich, Danilo F. S. Santos · 2024
Security has emerged as a paramount concern, fueled by the exponential growth of interconnected devices with inherent limitations in executing robust security measures. While frameworks like the Common Vulnerability Score System (CVSS) offer a structured approach to vulnerability assessment, and the Common Vulnerabilities and Exposures (CVE) database provides indispensable identifiers for known security flaws, comparing security solutions and technologies remains hard. This complexity stems from the diverse landscape of IoT devices and the dynamic nature of emerging threats, underscoring the imperative for ongoing innovation and collaboration among stakeholders. Despite these challenges, there is a pressing need for a cohesive methodology to evaluate and compare the security efficacy of various technologies and solutions. In this direction, our paper proposes the development of a tool designed to compute a security score based on the CVSS index assigned to each vulnerability within a given technology. This tool aims to facilitate decision-making among stakeholders when comparing technologies with security requirements. Besides describing the tool proposal, we shed light on potential challenges and avenues for enhancement in future iterations. In short, our proposed tool represents a significant step towards addressing the multifaceted challenges when deciding among technologies/solutions considering security aspects.